@oar-sh/oar 0.9.2 → 0.9.3

package/server/routes/messages-routes.mjs

@@ -15,6 +15,14 @@ import {
   persistConversationModelPreference as persistConversationModelPreferenceTx,
 } from '../services/conversation-preferences-service.mjs';
 import { killTmuxSession } from '../services/session-worker-launch-service.mjs';
+import { normalizeWorkerSteeringSnapshot } from '../services/session-worker-registry-service.mjs';
+import {
+  buildSteerSettleFailure,
+  steerAgentLabelForProvider,
+  STEER_SETTLE_FAILED_CODE,
+  STEER_SETTLE_FAILED_STABLE_CODE,
+} from '../../shared/steer-settle-failure.mjs';
+import { buildRelayStopFailure } from '../../shared/relay-stop-failure.mjs';
 import { stopSessionWorkerProcesses } from '../services/session-worker-stop-service.mjs';
 import {
   fetchUsageSummaryPromise,
@@ -29,6 +37,8 @@ import { openAIReasoningEffortsForModel } from '../../shared/openai-reasoning.mj
 import { DEFAULT_CLAUDE_REASONING_EFFORTS } from '../services/provider-reasoning-effort.mjs';
 import { claudeBaseModelId, claudeLongContextModelId } from '../../shared/model-id.mjs';
 import { sanitizeSubagentRunId } from '../../shared/subagent-run-id.mjs';
+import { STEER_FOLDED_TEXT } from '../../shared/steer-settle-markers.mjs';
+import { isLiveResend } from '../services/steer-resend.mjs';
 import { resolveProviderModelSelection } from '../services/provider-model-selection.mjs';
 
 export const SESSION_WORKER_OWNER_LEASE_MS = 120_000;
@@ -177,12 +187,20 @@ function findRecentDuplicateUserMessage({
   text = '',
   now = Date.now(),
   windowMs = DUPLICATE_USER_MESSAGE_WINDOW_MS,
+  // A message the user deliberately sends again (Resend of a steer a Stop
+  // cut off) is not a duplicate of its own original, nor of an earlier Resend
+  // of it that was cancelled or failed.
+  exemptMessageIds = [],
 } = {}) {
   const fingerprint = normalizeDuplicateMessageText(text);
   if (!fingerprint) return null;
   const maxAgeMs = Math.max(60_000, Number(windowMs) || DUPLICATE_USER_MESSAGE_WINDOW_MS);
+  const exempt = new Set((Array.isArray(exemptMessageIds) ? exemptMessageIds : [])
+    .map((id) => String(id || '').trim()).filter(Boolean));
+  const isExempt = (row) => exempt.has(String(row?.id || '').trim());
 
   for (const row of Array.isArray(recentUserMessages) ? recentUserMessages : []) {
+    if (isExempt(row)) continue;
     const rowText = normalizeDuplicateMessageText(row?.text || '');
     if (!rowText || rowText !== fingerprint) continue;
     const rowTime = Date.parse(row?.timestamp || '');
@@ -193,6 +211,7 @@ function findRecentDuplicateUserMessage({
   }
 
   for (const row of Array.isArray(recentQueueRows) ? recentQueueRows : []) {
+    if (isExempt(row)) continue;
     const rowText = normalizeDuplicateMessageText(row?.text || '');
     if (!rowText || rowText !== fingerprint) continue;
     const rowTime = Date.parse(row?.timestamp || '');
@@ -1757,6 +1776,10 @@ export function registerMessagesRoutes(app, deps) {
     sanitizeActivityText,
     readSessionTranscriptMessages,
     inFlightStateForConversation,
+    // Resolves the live turn among a conversation's processing rows (mid-turn
+    // steering can leave more than one). Falls back to the newest-processing
+    // query for older wiring/tests that do not supply it.
+    resolveLiveTurnQueueRow = (conversationId) => stmts.getLatestProcessingQueueByConversation.get(conversationId) || null,
     emitToClientsExceptSessionId,
     relayBridgeOwnerService,
     relayRestartOrchestrator,
@@ -1988,6 +2011,8 @@ export function registerMessagesRoutes(app, deps) {
     markWorkerError = true,
     executedProvider = null,
     attemptId = null,
+    // Extra writes that must commit only with the (fenced) failure itself.
+    withinTransaction = null,
   }) {
     const now = new Date().toISOString();
     const responseId = uuidv4();
@@ -2003,6 +2028,7 @@ export function registerMessagesRoutes(app, deps) {
         ? stmts.setFailedFenced.run(JSON.stringify(failureRecord), messageId, fencedAttemptId)
         : stmts.setFailed.run(JSON.stringify(failureRecord), messageId);
       if (result.changes === 0) return false;
+      if (typeof withinTransaction === 'function') withinTransaction(now);
       stmts.setQueueResponseMessageId?.run(responseId, messageId);
       stmts.insertMsg.run(
         responseId,
@@ -2017,6 +2043,7 @@ export function registerMessagesRoutes(app, deps) {
         modelActual,
         modelOrigin,
       );
+      stmts.setMessageSourceId?.run(messageId, responseId);
       // Provenance travels with terminal failures too — the original hijack
       // incident's signature was stolen turns dying on 402, which exited
       // exactly here with no executed_provider recorded.
@@ -2116,6 +2143,66 @@ export function registerMessagesRoutes(app, deps) {
   // pending — an answer may still be on its way in. A row with NO current
   // attempt (finalized by a legacy responder after a requeue cleared it) makes
   // every attempt-stamped card stale: the empty string matches none of them.
+  // The name the steer-settle wording uses for the runtime that took the
+  // prompt, from the conversation's provider type (the shared mapping the
+  // server runtime's recovery path uses too).
+  function steerSettleAgentLabelForConversation(conversationId) {
+    const id = String(conversationId || '').trim();
+    if (!id) return undefined;
+    return steerAgentLabelForProvider(stmts.getRuntimeSessionByConversation?.get?.(id)?.provider_type);
+  }
+
+  /**
+   * Terminal failure for a row whose prompt the worker's runtime already
+   * consumed — a folded or stopped steer whose settle never landed.
+   * At-most-once: every path that would requeue such a row comes here instead,
+   * since re-delivery would run the prompt a second time. `terminalError` lets
+   * a worker supply the path-accurate wording; the default is the fold wording.
+   */
+  function failConsumedQueueRow(queueRow, { reason = 'recovery', terminalError = null, attemptId = null } = {}) {
+    const agentLabel = steerSettleAgentLabelForConversation(queueRow?.conversation_id);
+    const failure = terminalError && typeof terminalError === 'object'
+      ? { ...buildSteerSettleFailure(queueRow, { agentLabel }), ...terminalError }
+      : buildSteerSettleFailure(queueRow, { agentLabel });
+    const failed = failQueueMessage({
+      queueRow,
+      messageId: queueRow.id,
+      conversationId: queueRow.conversation_id,
+      relayMode: normalizeRelayMode(queueRow.relay_mode) || DEFAULT_RELAY_MODE,
+      model: queueRow.model || null,
+      responseText: buildTerminalFailureTextForChat(failure),
+      failureRecord: {
+        ...failure,
+        kind: 'terminal',
+        error: 'terminal-error',
+        reason: String(reason || 'recovery'),
+        retryCount: Number(queueRow?.retry_count || 0),
+      },
+      markWorkerError: false,
+      attemptId,
+    });
+    if (failed) {
+      settleRelayAbortControlsForQueueMessage(queueRow.id, { ok: false, error: STEER_SETTLE_FAILED_CODE });
+      settleRelaySubagentAbortControlsForQueueMessage(queueRow.id, { ok: false, error: STEER_SETTLE_FAILED_CODE });
+      console.warn(`[${ts()}] FAILED    ${String(queueRow.id).slice(0, 8)} reason=${reason} code=${STEER_SETTLE_FAILED_STABLE_CODE} (consumed; never re-run)`);
+    }
+    return failed;
+  }
+
+  function normalizeConsumedSteerEntries(raw) {
+    const seen = new Set();
+    return (Array.isArray(raw) ? raw : [])
+      .map((entry) => (entry && typeof entry === 'object'
+        ? { id: String(entry.id || '').trim(), attemptId: String(entry.attemptId || '').trim() || null }
+        : { id: String(entry || '').trim(), attemptId: null }))
+      .filter((entry) => {
+        if (!entry.id || seen.has(entry.id)) return false;
+        seen.add(entry.id);
+        return true;
+      })
+      .slice(0, 100);
+  }
+
   function cancelPendingRelayQuestionsForMessage(messageId) {
     const targetMessageId = String(messageId || '').trim();
     if (!targetMessageId || typeof stmts.cancelPendingQuestionsForStaleAttempts?.all !== 'function') return 0;
@@ -2149,7 +2236,7 @@ export function registerMessagesRoutes(app, deps) {
           AND rs.sdk_session_id = ?
       )
       AND (q.next_attempt_at IS NULL OR q.next_attempt_at <= ?)
-    ORDER BY q.retry_count ASC, CASE WHEN q.next_attempt_at IS NULL THEN 0 ELSE 1 END ASC, COALESCE(q.next_attempt_at, q.timestamp) ASC, q.timestamp ASC
+    ORDER BY q.timestamp ASC, q.rowid ASC
     LIMIT 1
   `);
   const transferPendingOwnerToSession = db.prepare(`
@@ -2230,6 +2317,7 @@ export function registerMessagesRoutes(app, deps) {
     WHERE id = ?
       AND owner_sdk_session_id = ?
       AND status = 'processing'
+      AND consumed_at IS NULL
   `);
   const findMostRecentConversationForSession = db.prepare(`
     SELECT conversation_id
@@ -2409,15 +2497,7 @@ export function registerMessagesRoutes(app, deps) {
   }
 
   function buildRelayStopFailurePayload() {
-    return {
-      kind: 'turn-aborted',
-      error: 'turn-aborted',
-      code: 'turn-aborted',
-      stableCode: 'relay.turn-aborted',
-      message: 'System note: This turn was stopped from the relay UI before completion.',
-      guidance: 'Send a new message to continue when you are ready.',
-      failedAt: new Date().toISOString(),
-    };
+    return buildRelayStopFailure();
   }
 
   function settleRelayAbortControlsForQueueMessage(queueMessageId, { ok = true, note = null, error = null } = {}) {
@@ -2500,6 +2580,10 @@ export function registerMessagesRoutes(app, deps) {
         io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
         continue;
       }
+      if (row.consumed_at) {
+        failConsumedQueueRow(row, { reason });
+        continue;
+      }
       const relayActivityRows = stmts.listActivityByQueueMessage?.all?.(row.id);
       const relayStreamRows = stmts.listStreamEventsByQueueMessage?.all?.(row.id);
       const fallbackRelayActivities = Array.isArray(relayActivityRows)
@@ -2747,7 +2831,10 @@ export function registerMessagesRoutes(app, deps) {
       return rejectSessionBinding(res, sessionState.status, sessionState.error);
     }
 
-    const queueRow = stmts.getLatestProcessingQueueByConversation.get(conversationId) || null;
+    // The live turn, not merely the newest processing row: a steered message
+    // folded into the running turn is also `processing`, and Stop must target
+    // the turn actually executing (which the worker interrupts as a whole).
+    const queueRow = resolveLiveTurnQueueRow(conversationId) || null;
     if (!queueRow) {
       return res.json({
         ok: true,
@@ -2946,6 +3033,44 @@ export function registerMessagesRoutes(app, deps) {
     });
   });
 
+  // The session worker that can still pull a processing row back out of its
+  // runtime: the row's owner first (the worker that claimed it), then the
+  // conversation's bound session. Only a worker whose latest heartbeat lists
+  // the id as cancellable qualifies — the relay never guesses at the runtime's
+  // queue state.
+  function findWorkerHoldingCancellableMessage({ queueRow, conversationId, messageId }) {
+    if (typeof sessionWorkerRegistry?.getWorker !== 'function') return null;
+    const conversation = stmts.getConvAnyStatus?.get?.(conversationId) || null;
+    const candidates = [...new Set([
+      normalizeSessionWorkerId(queueRow?.owner_sdk_session_id),
+      normalizeSessionWorkerId(conversation?.sdk_session_id),
+    ].filter(Boolean))];
+    for (const sessionId of candidates) {
+      const worker = sessionWorkerRegistry.getWorker(sessionId);
+      const cancellableIds = Array.isArray(worker?.steering?.cancellableIds) ? worker.steering.cancellableIds : [];
+      if (cancellableIds.includes(messageId)) return worker;
+    }
+    return null;
+  }
+
+  // Asks the owning worker to remove a pushed-but-unconsumed row from its
+  // runtime (`cancel_pushed_message`). True when the control went out over a
+  // live worker socket; the worker then settles the row through
+  // POST /api/queue-cancelled. False (no such worker, id not cancellable, or
+  // the socket is gone) leaves the row on its ordinary path.
+  function requestPushedMessageCancel({ queueRow, conversationId, messageId }) {
+    const worker = findWorkerHoldingCancellableMessage({ queueRow, conversationId, messageId });
+    if (!worker) return false;
+    const sent = sendWorkerControl?.(worker.sdkSessionId, {
+      type: 'cancel_pushed_message',
+      messageId,
+      conversationId,
+    });
+    if (!sent) return false;
+    console.log(`[${ts()}] UNSTEER REQ ${messageId.slice(0, 8)} conv=${conversationId.slice(0, 8)}`);
+    return true;
+  }
+
   app.post('/api/conversation/:conversationId/cancel-queued-turn', auth, (req, res) => {
     const conversationId = String(req.params.conversationId || '').trim();
     const requestedMessageId = String(req.body?.messageId || '').trim();
@@ -2979,6 +3104,19 @@ export function registerMessagesRoutes(app, deps) {
 
     const currentStatus = String(queueRow.status || '').trim().toLowerCase();
     if (currentStatus === 'processing') {
+      // Un-steer: a row the owning worker pushed into its runtime but reports
+      // as still unconsumed (heartbeat `steering.cancellableIds`) can be pulled
+      // back out. The worker answers through POST /api/queue-cancelled once the
+      // runtime confirms the removal; until then the row stays processing.
+      if (requestPushedMessageCancel({ queueRow, conversationId, messageId: requestedMessageId })) {
+        return res.json({
+          ok: true,
+          cancelled: false,
+          acknowledgement: 'cancel-requested',
+          requestedMessageId,
+          status: currentStatus,
+        });
+      }
       return res.json({
         ok: true,
         cancelled: false,
@@ -3851,6 +3989,52 @@ export function registerMessagesRoutes(app, deps) {
     });
   });
 
+  // A Resend of a steer a Stop cut off unanswered. Honored only for a user
+  // message of this conversation whose own settle marker is kind='stopped' and
+  // whose text is what is being sent; anything else is an ordinary send (and
+  // gets the ordinary duplicate guard). Returns { originId } to honor it,
+  // { alreadyResentAs } when an earlier Resend of it still stands (from any
+  // device, at any time), or null.
+  function resolveStoppedSteerResend(conversationId, rawMessageId, text) {
+    const messageId = String(rawMessageId || '').trim();
+    if (!messageId || !conversationId) return null;
+    try {
+      const original = db.prepare(`
+        SELECT id, text, mode FROM messages WHERE id = ? AND conversation_id = ? AND role = 'user'
+      `).get(messageId, conversationId);
+      if (!original) return null;
+      // Stored user text may carry the relay's prompt context; the incoming
+      // text is already stripped, so compare like with like.
+      const originalText = stripRelayPromptContext(original.text, original.mode);
+      if (normalizeDuplicateMessageText(originalText) !== normalizeDuplicateMessageText(text)) return null;
+      const stopped = db.prepare(`
+        SELECT 1 FROM messages
+        WHERE conversation_id = ? AND role = 'assistant' AND kind = 'stopped'
+          AND (source_message_id = ? OR id IN (SELECT response_message_id FROM queue WHERE id = ?))
+        LIMIT 1
+      `).get(conversationId, messageId, messageId);
+      if (!stopped) return null;
+      const earlier = db.prepare(`
+        SELECT m.id,
+          q.id AS queue_id,
+          q.status AS queue_status,
+          EXISTS (SELECT 1 FROM messages a WHERE a.role = 'assistant' AND a.source_message_id = m.id) AS answered
+        FROM messages m
+        LEFT JOIN queue q ON q.id = m.id
+        WHERE m.conversation_id = ? AND m.role = 'user' AND m.resend_of_message_id = ?
+      `).all(conversationId, messageId);
+      const standing = earlier.find((row) => isLiveResend({
+        hasQueueRow: !!row.queue_id,
+        queueStatus: row.queue_status,
+        answered: !!row.answered,
+      }));
+      if (standing) return { alreadyResentAs: standing.id };
+      return { originId: messageId, exemptIds: [messageId, ...earlier.map((row) => row.id)] };
+    } catch {
+      return null;
+    }
+  }
+
   // POST /api/message — browser sends a message
   app.post('/api/message', auth, async (req, res) => {
     const {
@@ -3877,6 +4061,10 @@ export function registerMessagesRoutes(app, deps) {
     const requestedRelayMode = normalizeRelayMode(relayMode || mode);
     const trimmedText = stripRelayPromptContext(text, requestedRelayMode || relayMode || mode);
     const normalizedAttachments = normalizeAttachments(rawAttachments);
+    const requestedAttachmentCount = Math.min(
+      MAX_UPLOAD_ATTACHMENTS,
+      Array.isArray(rawAttachments) ? rawAttachments.filter((item) => item && typeof item === 'object').length : (rawAttachments ? 1 : 0),
+    );
     const referenceResolution = collectReferenceAttachmentsFromText(trimmedText);
     const attachments = mergeMessageAttachments(normalizedAttachments, referenceResolution.attachments);
     const imageTarget = rawImageTarget && typeof rawImageTarget === 'object'
@@ -4346,6 +4534,19 @@ export function registerMessagesRoutes(app, deps) {
       }
     }
 
+    const resend = shouldCreateConversation
+      ? null
+      : resolveStoppedSteerResend(conversationId, req.body.resendOfMessageId, trimmedText);
+    if (resend?.alreadyResentAs) {
+      return res.json({
+        ok: true,
+        duplicate: true,
+        alreadyResent: true,
+        duplicateOfMessageId: resend.alreadyResentAs,
+        conversationId,
+      });
+    }
+    const resendOriginId = resend?.originId || null;
     if (!shouldCreateConversation) {
       const recentUserMessages = stmts.getRecentMessagesDesc.all(conversationId, 20);
       const recentQueueRows = db.prepare(`
@@ -4359,6 +4560,7 @@ export function registerMessagesRoutes(app, deps) {
         recentUserMessages,
         recentQueueRows,
         text: trimmedText,
+        exemptMessageIds: resend?.exemptIds || [],
       });
       if (duplicateMessage) {
         return res.json({
@@ -4464,27 +4666,32 @@ export function registerMessagesRoutes(app, deps) {
       );
       linkUploadReferences(convId, msgId, attachments);
       stmts.updateConvTime.run(now, convId);
-      if (typeof stmts.updateConvDraft?.run === 'function') {
-        stmts.updateConvDraft.run(null, now, sessionId || null, convId);
-      } else {
-        db.prepare(`
-          UPDATE conversations
-          SET draft_text = NULL, draft_updated_at = ?, draft_updated_by_client_id = ?
-          WHERE id = ?
-        `).run(now, sessionId || null, convId);
-      }
-      // The message now owns these blobs, so the draft placeholders can go. The
-      // sent-message references were just inserted above, so nothing is orphaned.
-      if (typeof stmts.updateConvDraftAttachments?.run === 'function') {
-        stmts.updateConvDraftAttachments.run(null, now, sessionId || null, convId);
-      } else {
-        db.prepare(`
-          UPDATE conversations
-          SET draft_attachments = NULL, draft_updated_at = ?, draft_updated_by_client_id = ?
-          WHERE id = ?
-        `).run(now, sessionId || null, convId);
+      if (resendOriginId) stmts.setMessageResendOf?.run(resendOriginId, msgId);
+      // A Resend never came from the composer: whatever the user is typing
+      // there stays their draft.
+      if (!resendOriginId) {
+        if (typeof stmts.updateConvDraft?.run === 'function') {
+          stmts.updateConvDraft.run(null, now, sessionId || null, convId);
+        } else {
+          db.prepare(`
+            UPDATE conversations
+            SET draft_text = NULL, draft_updated_at = ?, draft_updated_by_client_id = ?
+            WHERE id = ?
+          `).run(now, sessionId || null, convId);
+        }
+        // The message now owns these blobs, so the draft placeholders can go. The
+        // sent-message references were just inserted above, so nothing is orphaned.
+        if (typeof stmts.updateConvDraftAttachments?.run === 'function') {
+          stmts.updateConvDraftAttachments.run(null, now, sessionId || null, convId);
+        } else {
+          db.prepare(`
+            UPDATE conversations
+            SET draft_attachments = NULL, draft_updated_at = ?, draft_updated_by_client_id = ?
+            WHERE id = ?
+          `).run(now, sessionId || null, convId);
+        }
+        stmts.deleteDraftUploadRefs?.run?.(convId);
       }
-      stmts.deleteDraftUploadRefs?.run?.(convId);
       // Cursor allows per-turn model switching, so the pinned provider_model has
       // to follow the accepted model; otherwise the conversation list and the
       // composer keep restoring the model chosen at bootstrap.
@@ -4574,14 +4781,16 @@ export function registerMessagesRoutes(app, deps) {
       }
       throw error;
     }
-    io.emit('conversation_draft_updated', {
-      conversationId: convId,
-      draftText: '',
-      draftAttachments: [],
-      draftUpdatedAt: now,
-      draftUpdatedByClientId: sessionId || null,
-      senderClientId: sessionId || null,
-    });
+    if (!resendOriginId) {
+      io.emit('conversation_draft_updated', {
+        conversationId: convId,
+        draftText: '',
+        draftAttachments: [],
+        draftUpdatedAt: now,
+        draftUpdatedByClientId: sessionId || null,
+        senderClientId: sessionId || null,
+      });
+    }
     if (ownerSessionId) {
       const existingWorker = sessionWorkerRegistry?.getWorker?.(ownerSessionId) || null;
       sessionWorkerRegistry?.upsertWorker?.({
@@ -4697,6 +4906,9 @@ export function registerMessagesRoutes(app, deps) {
       ...workspaceRootPayload(),
       referenceAttachmentCount: referenceResolution.attachments.length,
       skippedReferenceAttachments: referenceResolution.skipped,
+      // Attachment references that no longer resolve (a deleted upload) are
+      // dropped silently by normalizeAttachments; the sender is told how many.
+      droppedAttachmentCount: Math.max(0, requestedAttachmentCount - normalizedAttachments.length),
       imageOperation: imageOperation
         ? {
             id: imageOperation.id,
@@ -4711,6 +4923,8 @@ export function registerMessagesRoutes(app, deps) {
     touchCli();
     const requester = readBridgeIdentity(req);
     const requesterSessionId = normalizeSessionWorkerId(requester?.sessionId);
+    const settleFailedHandled = [];
+    const settleFailedSkipped = [];
     const activeQueueMessageId = String(req.body?.activeQueueMessageId || '').trim();
     // A persistent-process worker can hold several live rows at once (the
     // running turn plus a delivered message queued behind it plus a
@@ -4746,7 +4960,71 @@ export function registerMessagesRoutes(app, deps) {
           pid: normalizedRequesterPid,
         });
       }
+      // The worker's composer-facing steering snapshot rides the heartbeat;
+      // store it on the registry entry (status payload spreads it to clients)
+      // only when it actually changed, so quiet heartbeats stay write-free.
+      // Normalized with the registry's own rules BEFORE comparing — comparing
+      // raw against stored would never converge for values the registry drops.
+      const steering = normalizeWorkerSteeringSnapshot(req.body?.steering);
+      if (steering) {
+        const workerForSteering = sessionWorkerRegistry?.getWorker?.(requesterSessionId) || null;
+        const stored = workerForSteering?.steering || null;
+        const storedCancellableIds = Array.isArray(stored?.cancellableIds) ? stored.cancellableIds : [];
+        const changed = !stored
+          || stored.turnActive !== steering.turnActive
+          || stored.canSteer !== steering.canSteer
+          || (stored.holdReason || null) !== (steering.holdReason || null)
+          || (stored.messageId || null) !== (steering.messageId || null)
+          // The Copilot SDK worker's opt-in and its un-steerable set: a flip
+          // in either must reach the status payload (composer gate, bubble
+          // Cancel), so it counts as a change like the hold fields do.
+          || (stored.supported === true) !== (steering.supported === true)
+          || storedCancellableIds.join('\n') !== steering.cancellableIds.join('\n');
+        if (workerForSteering && changed) {
+          sessionWorkerRegistry?.upsertWorker?.({ ...workerForSteering, steering });
+          // Pushed rather than left for the clients' status poll: the
+          // composer's Steer/Queue label and the pushed rows' Cancel read it,
+          // and the poll would add up to 4 s to a heartbeat that already lags.
+          io.emit('session_worker_steering', { sdkSessionId: requesterSessionId, steering });
+        }
+      }
       sessionWorkerSupervisor?.noteSessionHeartbeat?.(requesterSessionId);
+      // Consumed steers whose settle the worker could not save within its
+      // retry budget (e.g. its writes keep failing): the relay fails them
+      // itself with the worker's terminal error, never requeueing them.
+      const settleFailedEntries = Array.isArray(req.body?.settleFailed) ? req.body.settleFailed.slice(0, 50) : [];
+      const requesterConversationForSettle = String(requester?.conversationId || '').trim() || null;
+      for (const entry of settleFailedEntries) {
+        const id = String(entry?.id || '').trim();
+        const row = id ? stmts.findQById.get(id) : null;
+        if (!row || row.status !== 'processing') {
+          if (id) settleFailedHandled.push(id);
+          continue;
+        }
+        // Only the worker that owns the row may have it failed, and only in a
+        // conversation that worker serves.
+        // Anything else is acknowledged as skipped: the worker has no claim on
+        // the row, so it stops reporting it (and releases its hold), and the
+        // row takes the ordinary recovery path — where a consumed mark still
+        // fails it rather than re-running it.
+        const rowSession = normalizeSessionWorkerId(stmts.getRuntimeSessionByConversation?.get(row.conversation_id)?.sdk_session_id);
+        if (normalizeSessionWorkerId(row.owner_sdk_session_id) !== requesterSessionId
+          || (rowSession !== requesterSessionId && String(row.conversation_id) !== String(requesterConversationForSettle || ''))) {
+          settleFailedSkipped.push(id);
+          continue;
+        }
+        const attemptId = String(entry?.attemptId || '').trim() || null;
+        if (attemptId && String(row.attempt_id || '') !== attemptId) {
+          settleFailedHandled.push(id);
+          continue;
+        }
+        failConsumedQueueRow(row, {
+          reason: 'settle-failed',
+          terminalError: entry?.terminalError && typeof entry.terminalError === 'object' ? entry.terminalError : null,
+          attemptId,
+        });
+        settleFailedHandled.push(id);
+      }
       if (activeQueueMessageIds.length) {
         const now = new Date().toISOString();
         const leaseExpiresAt = addMsToIso(now, SESSION_WORKER_OWNER_LEASE_MS);
@@ -4765,7 +5043,91 @@ export function registerMessagesRoutes(app, deps) {
     }
     relayBridgeOwnerService?.observe?.(requester);
     const { pendingCount } = queueCounts();
-    res.json({ ok: true, pendingCount });
+    res.json({
+      ok: true,
+      pendingCount,
+      ...(settleFailedHandled.length ? { settleFailedHandled } : {}),
+      ...(settleFailedSkipped.length ? { settleFailedSkipped } : {}),
+    });
+  });
+
+  // POST /api/queue-consumed — the Claude worker marks rows whose prompt the
+  // CLI has taken when no response carries the mark (a turn the user stopped,
+  // a turn handed off mid-reply). Consumed rows are at-most-once: recovery
+  // fails them terminally instead of re-running them.
+  app.post('/api/queue-consumed', auth, (req, res) => {
+    touchCli();
+    const requesterSessionId = normalizeSessionWorkerId(readBridgeIdentity(req)?.sessionId);
+    if (!requesterSessionId) return res.status(403).json({ error: 'Worker identity required' });
+    const conversationId = String(req.body?.conversationId || '').trim();
+    const entries = normalizeConsumedSteerEntries(req.body?.entries);
+    if (!conversationId || !entries.length) return res.status(400).json({ error: 'Missing conversationId or entries' });
+    // `consumed: false` un-marks a steer the CLI then replayed as a turn of
+    // its own. Either way only the owning worker, on the row's current
+    // attempt, may touch the mark.
+    const statement = req.body?.consumed === false ? stmts.clearQueueConsumed : stmts.markQueueConsumed;
+    const at = new Date().toISOString();
+    let changed = 0;
+    for (const entry of entries) {
+      changed += Number(statement?.run({
+        at,
+        id: entry.id,
+        conversationId,
+        owner: requesterSessionId,
+        attemptId: entry.attemptId,
+      })?.changes || 0);
+    }
+    res.json({ ok: true, changed });
+  });
+
+  // POST /api/queue-cancelled — the owning worker reports that a pushed but
+  // still unconsumed row was removed from its runtime (an un-steer the user
+  // asked for through cancel-queued-turn → `cancel_pushed_message`). The row
+  // ends exactly like a pending cancel: deleted, its open cards cancelled, no
+  // assistant row, `message_status: cancelled`. Fenced like /api/queue-consumed:
+  // only the row's owner, on the row's current attempt, may settle it.
+  app.post('/api/queue-cancelled', auth, (req, res) => {
+    touchCli();
+    const requesterSessionId = normalizeSessionWorkerId(readBridgeIdentity(req)?.sessionId);
+    if (!requesterSessionId) return res.status(403).json({ error: 'Worker identity required' });
+    const conversationId = String(req.body?.conversationId || '').trim();
+    const messageId = String(req.body?.messageId || '').trim();
+    const attemptId = String(req.body?.attemptId || '').trim() || null;
+    if (!conversationId || !messageId) return res.status(400).json({ error: 'Missing conversationId or messageId' });
+
+    const row = stmts.findQById.get(messageId) || null;
+    if (!row) return res.status(404).json({ error: 'not-found' });
+    if (String(row.conversation_id || '').trim() !== conversationId) {
+      return res.status(409).json({ error: 'conversation-mismatch' });
+    }
+    const status = String(row.status || '').trim().toLowerCase();
+    if (status !== 'processing') return res.status(409).json({ error: 'not-processing', status });
+    if (normalizeSessionWorkerId(row.owner_sdk_session_id) !== requesterSessionId) {
+      return res.status(409).json({ error: 'not-owned' });
+    }
+    const rowAttemptId = String(row.attempt_id || '').trim() || null;
+    if (attemptId && rowAttemptId && attemptId !== rowAttemptId) {
+      console.warn(`[${ts()}] STALE ATTEMPT queue-cancelled ${messageId.slice(0, 8)} attempt=${attemptId.slice(0, 8)} current=${rowAttemptId.slice(0, 8)}`);
+      return res.status(409).json({ error: 'stale_attempt' });
+    }
+
+    // Same transaction shape as the pending cancel above: delete first, so the
+    // question cancel sees no current attempt and flips every pending card of
+    // the row (with foreign keys on, the cascade has already taken them).
+    const cancelPushedTurn = db.transaction(() => {
+      stmts.deleteQueueById.run(messageId);
+      cancelPendingRelayQuestionsForMessage(messageId);
+    });
+    cancelPushedTurn();
+    // A processing row may carry open Stop controls (the live-turn picker can
+    // land on it before it has output); they fail like on a requeue so no
+    // caller waits on a row that no longer exists.
+    settleRelayAbortControlsForQueueMessage(messageId, { ok: false, error: 'queue-cancelled' });
+    settleRelaySubagentAbortControlsForQueueMessage(messageId, { ok: false, error: 'queue-cancelled' });
+
+    io.emit('message_status', { messageId, conversationId, status: 'cancelled' });
+    console.log(`[${ts()}] UNSTEERED ${messageId.slice(0, 8)} conv=${conversationId.slice(0, 8)}`);
+    res.json({ ok: true, cancelled: true });
   });
 
   // POST /api/grok-native-session — Grok worker persists the ACP session id so
@@ -6054,10 +6416,49 @@ export function registerMessagesRoutes(app, deps) {
     });
   });
 
+  const SETTLED_STEER_KINDS = new Set(['folded', 'stopped']);
+
   // POST /api/response — CLI submits response
   app.post('/api/response', auth, async (req, res) => {
     touchCli();
     const { messageId, conversationId, text, model, mode, generatedImages: rawGeneratedImages } = req.body;
+    // A steering absorption (Claude worker): this reply ends where a message
+    // pushed mid-turn was picked up, and the turn continues on that message's
+    // own row. Stamped as kind='absorbed' so the transcript renders the two
+    // turns as one merged flow.
+    // A worker not yet respawned onto 0.9.3 still stamps its fold stubs
+    // absorbed:true; the stub text identifies them, and 'absorbed' on a fold
+    // would mis-merge the next ordinary message.
+    const staleFoldStub = req.body.absorbed === true && String(text || '').trim() === STEER_FOLDED_TEXT;
+    const absorbed = req.body.absorbed === true && !staleFoldStub;
+    // The other settle stubs of a consumed steer (never re-run — the CLI saw
+    // it): 'folded' was answered by the turn it was steered into and renders
+    // as a marker on its own message; 'stopped' was steered into a turn the
+    // user then stopped, so it went unanswered and the client offers Resend.
+    const requestedKind = staleFoldStub ? 'folded' : String(req.body.kind || '').trim();
+    const settledKind = absorbed
+      ? 'absorbed'
+      : (SETTLED_STEER_KINDS.has(requestedKind) ? requestedKind : null);
+    // Steers pushed into the turn this response finishes and not yet settled:
+    // the CLI has taken their prompts, so they are marked consumed together
+    // with this commit and no recovery path may ever re-run them.
+    const consumedSteerEntries = normalizeConsumedSteerEntries(req.body.consumedSteerIds)
+      .filter((entry) => entry.id !== String(messageId || '').trim());
+    // Runs inside the response's fenced write (both the success and the
+    // terminal-failure transaction), so a superseded attempt's late publish
+    // can never mark rows; the steers must share the finishing row's owner.
+    const markSteersConsumed = (conversationIdForMark, atIso) => {
+      const owner = normalizeSessionWorkerId(q?.owner_sdk_session_id);
+      for (const entry of consumedSteerEntries) {
+        stmts.markQueueConsumed?.run({
+          at: atIso,
+          id: entry.id,
+          conversationId: conversationIdForMark,
+          owner,
+          attemptId: entry.attemptId,
+        });
+      }
+    };
     const trimmedText = String(text || '').trim();
     const terminalFailure = resolveTerminalFailurePayload(req.body, { fallbackText: trimmedText });
     // Final digests of background workflows that settled during this turn —
@@ -6159,6 +6560,8 @@ export function registerMessagesRoutes(app, deps) {
           failedAt: new Date().toISOString(),
         },
         attemptId: claimedAttemptId,
+        // An errored turn still took the steers pushed into it.
+        withinTransaction: (atIso) => markSteersConsumed(targetConversationId, atIso),
       });
       if (!failed) {
         const currentRow = stmts.findQById?.get(messageId) || null;
@@ -6266,6 +6669,7 @@ export function registerMessagesRoutes(app, deps) {
         ? stmts.setDoneFenced.run(resolvedText, messageId, claimedAttemptId)
         : stmts.setDone.run(resolvedText, messageId);
       if (result.changes === 0) return false;
+      markSteersConsumed(targetConversationId, now);
       stmts.setQueueResponseMessageId?.run(responseId, messageId);
       stmts.insertMsg.run(
         responseId,
@@ -6280,8 +6684,11 @@ export function registerMessagesRoutes(app, deps) {
         explicitModel,
         modelOrigin,
       );
+      stmts.setMessageSourceId?.run(messageId, responseId);
       if (String(q?.kind || '') === 'continuation') {
         stmts.setMessageKind?.run('continuation', responseId);
+      } else if (settledKind) {
+        stmts.setMessageKind?.run(settledKind, responseId);
       }
       // The workflow cards persist atomically with the assistant message they
       // annotate — keyed directly on the response id (see workflow_runs DDL).
@@ -6509,6 +6916,9 @@ export function registerMessagesRoutes(app, deps) {
       messageId: responseId,
       message: {
         role: 'assistant',
+        // In the message too, as on reload: a stopped marker's Resend finds
+        // its original through it.
+        sourceMessageId: messageId,
         text: resolvedText,
         attachments: emittedImageAttachments.length ? emittedImageAttachments : undefined,
         model: resolvedAssistantModel,
@@ -6520,18 +6930,25 @@ export function registerMessagesRoutes(app, deps) {
         activities,
         thoughts,
         executedProvider,
-        kind: String(q?.kind || '') === 'continuation' ? 'continuation' : undefined,
+        kind: String(q?.kind || '') === 'continuation'
+          ? 'continuation'
+          : (settledKind || undefined),
         // Live-appended messages must show their workflow cards without a
         // reload; conversation reloads serve the same digests from the DB.
         workflowRuns: workflowRuns.length ? workflowRuns : undefined,
       },
     });
     io.emit('message_status', { messageId, conversationId: targetConversationId, status: 'done' });
-    void pushDispatchService?.notifyTurnComplete?.({
-      conversationId: targetConversationId,
-      messageId: responseId,
-      text: resolvedText,
-    });
+    // An absorbed row is not a finished turn — the reply continues on the
+    // steered message's row, whose own completion sends the one notification.
+    // A stopped steer has no reply at all.
+    if (!settledKind) {
+      void pushDispatchService?.notifyTurnComplete?.({
+        conversationId: targetConversationId,
+        messageId: responseId,
+        text: resolvedText,
+      });
+    }
     cancelPendingRelayQuestionsForMessage(messageId);
     res.json({ ok: true });
   });
@@ -6639,6 +7056,7 @@ export function registerMessagesRoutes(app, deps) {
         startedAt: Number(task?.startedAt) || null,
         summary: String(task?.summary || '').trim().slice(0, 500) || null,
         lastToolName: String(task?.lastToolName || '').trim() || null,
+        lastToolCall: String(task?.lastToolCall || '').replace(/\s+/g, ' ').trim().slice(0, 300) || null,
         totalTokens: Number.isFinite(Number(task?.totalTokens)) ? Number(task.totalTokens) : null,
         subagentType: String(task?.subagentType || '').trim().slice(0, 120) || null,
         model: String(task?.model || '').trim().slice(0, 120) || null,
@@ -7091,6 +7509,11 @@ export function registerMessagesRoutes(app, deps) {
       console.log(`[${ts()}] CONTINUATION DROPPED ${messageId?.slice(0,8)} reason=requeue`);
       return res.json({ ok: true, dropped: 'continuation' });
     }
+    if (q && q.status === 'processing' && q.consumed_at) {
+      // The CLI already took this prompt: any requeue class would run it again.
+      failConsumedQueueRow(q, { reason: 'requeue', attemptId: claimedAttemptId });
+      return res.json({ ok: true, terminal: true, code: STEER_SETTLE_FAILED_STABLE_CODE });
+    }
     if (q && q.status === 'processing' && String(req.body?.code || '').trim() === 'relay.provider-mismatch') {
       // A routing refusal, not a delivery failure: the legacy relay handed
       // back a turn that belongs to a session worker. No retry increment and
@@ -7105,6 +7528,25 @@ export function registerMessagesRoutes(app, deps) {
       console.log(`[${ts()}] REQUEUED  ${messageId?.slice(0,8)} class=provider-mismatch retry=${Number(q.retry_count || 0)}`);
       return res.json({ ok: true, mismatch: true });
     }
+    if (q && q.status === 'processing' && String(req.body?.class || '').trim() === 'steering-held') {
+      // The worker refused to push the message because its live turn is
+      // holding steering (an open question card, a compaction, an adoption).
+      // Not a failure: no retry increment, no backoff, and the owner is kept —
+      // the same worker takes it again the moment it signals ready, which is
+      // when the hold ends, so the message steers into the resumed turn.
+      const result = db.prepare(`
+        UPDATE queue
+        SET status = 'pending', processing_at = NULL, attempt_id = NULL, next_attempt_at = NULL, owner_lease_expires_at = NULL
+        WHERE id = ? AND status = 'processing'${claimedAttemptId ? ` AND attempt_id = ?` : ''}
+      `).run(...(claimedAttemptId ? [messageId, claimedAttemptId] : [messageId]));
+      if (result.changes > 0) {
+        settleRelayAbortControlsForQueueMessage(messageId, { ok: false, error: 'queue-requeued' });
+        settleRelaySubagentAbortControlsForQueueMessage(messageId, { ok: false, error: 'queue-requeued' });
+        io.emit('message_status', { messageId, conversationId: q.conversation_id, status: 'pending' });
+        console.log(`[${ts()}] REQUEUED  ${messageId?.slice(0,8)} class=steering-held retry=${Number(q.retry_count || 0)}`);
+      }
+      return res.json({ ok: true, held: true });
+    }
     if (q && q.status === 'processing') {
       const retryCount = Number(q.retry_count || 0) + 1;
       if (retryCount >= MAX_REQUEUE_RETRIES) {